SAML assertion parameters

When authentication is performed using a SAML IdP, the parameters received that can be of interest to the PasswordReset module are:
(use SAML-tracer, for example, to see the incoming SAML data)

• Subject (NameID) Holds the value of the user who logged in.
  Use request.user_name if you would like to use it in a PIPE.
• display_name. The PasswordReset module can also use this attribute if available. This will, for example, be used by the avatar in the Password Reset application to display the user name.
  Use request.display_name if you would like to use it in a PIPE.
• email. The PasswordReset module can also use this attribute if available.
  Use request.email if you would like to use it in a PIPE.
• on_behalf_of_user_name
  Use request.on_behalf_of_user_name if you would like to use it in a PIPE.
• on_behalf_of_display_name
  Use request.on_behalf_of_display_name if you would like to use it in a PIPE.
• on_behalf_of_email
  Use request.on_behalf_of_email if you would like to use it in a PIPE.
• password_policy
  Used to select which configured policy in rule_policies should be applied for the current session. If the value does not match a configured policy, the policy with default: true will be used.
• pwd_last_set
  To prevent users from resetting the password multiple times in a row, you can (as in AD) add a time value in days to specify how long they need to wait before resetting it again. This parameter will use the value below and pwdLastSet to determine when to prompt the user. If this parameter is not present, the evaluation will be done after the user tries to reset their password.
• pwd_last_set_allowed_days
  Use pwd_last_set_allowed_days together with pwd_last_set to make an early check of time restrictions.